# Agentic Payments Landscape > Source: > Published: 2026-07-21 15:56:20+00:00 # The state of agent payments. Five checkout and settlement standards now compete to become how software spends money, and most of them are less than fourteen months old. The only binding text governing any of it is a card scheme's private rulebook — no statute in the US, UK, EU, Singapore or India requires an agent to identify itself as one, and nobody has allocated the loss when an agent is talked into paying. This is every protocol, rulebook and rail in that gap: what each one ships today, and what it has only announced. ## The stack Four contested layers over one uncontested substrate. Discovery does not get its own band — UCP treats discovery through post-purchase as a single protocol, which is the industry's own answer to where that boundary sits. Click any protocol to jump to its entry. ## Protocol catalog Every protocol, rulebook and rail in scope, grouped by the layer it operates at. **Status** separates what ships today from what was only announced. Expand any card for mechanics, known gaps and named adopters. ## What moved Status transitions, new capabilities and corrections to the record, newest first. Longer-run history lives in the timeline below; this is only what has changed recently. Movement history appears once the pipeline has run. ## Who governs what Standards-body cover is thinner than the press releases suggest. No binding rule requiring agent identity in payments exists in the US, UK, EU, Singapore or India. | Body | Owns | State | Since | Reality check | |---| ## By jurisdiction Ordered by how far each regulator has actually gone. The gap between rhetoric and rule is wide everywhere — and the only binding text governing agent payments anywhere in the world is a card scheme's private rulebook. | Jurisdiction | Posture | What exists | Binding? | |---| ## Regulatory clock The binding constraints over the next 24 months are not new AI rules — they are old rules with 2026 and 2027 dates. Three comment windows are open right now — two US, one Indian — and all three are places to put a position on the record before the frameworks harden. **Nobody has allocated prompt-injection loss.** Not Visa, not Mastercard, not Reg E, not Reg Z, not PSD2, not PSD3/PSR. Amex's Agent Purchase Protection is the sole exception and covers only registered-agent error against certified intent. Price it as an uninsured operating cost. ## How it happened Six years from LSAT — the first HTTP-402 revival, five years before x402 — to a landscape with five competing checkout and settlement standards, one binding rulebook, and an unresolved federal appeal over whether agents may act inside a logged-in session at all. Most of it happened in the last fourteen months. ## Watchlist Names that keep coming up but are **not** in the catalog above, with how often they have appeared. Being mentioned is not the same as being real — this is a reason to look, not a claim that any of it matters yet. Nothing on the watchlist.